Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

creating a contact named "omdadmin" makes site unusable #131

Open
systemdlete opened this issue Oct 5, 2021 · 3 comments
Open

creating a contact named "omdadmin" makes site unusable #131

systemdlete opened this issue Oct 5, 2021 · 3 comments

Comments

@systemdlete
Copy link

Doing the following:

omd create newsite
omd start newsite
(log in to newsite)
Config Tool->Object settings->Contacts->Create a new contact
save to: contacts.cfg
contact_name: omdadmin
alias: OMD Admin
email: someone@localhost
apply

Note that even if I select the radio button for submitting commands, the following error appears:

missing backend configuration
'please specify at least one backend in your thruk_local.conf
Please read the setup instructions.'

After this, the site is largely unusable, particularly the Config Tool

In addition, selecting Process Info gives me this error:

It appears as though you do not have permission to view process information...
'If you believe this is an error, check the HTTP server authentication requirements for accessing this CGI
and check the authorization options in your CGI configuration file.'

the thruk.log gives the same error info

I have not been able to figure out how to recover from this. One suspicion I have is the change from debian to devuan. I realize mostly this change should not be consequential, except if OMD and its subsidiary systems are detecting a distro called "devuan" and not matching on a case statement, or the like. Otherwise, I would think that in the context of omd and its subsystems, devuan should behave and look and feel pretty much like debian or any debian derivative.

Environment:
Devuan Beowulf (Debian Buster sans systemd)
omd labs 4.20
firefox 78.14.0esr (but also tried with recent chromium browser, with same result)

naemon.log

apache.log

@systemdlete
Copy link
Author

systemdlete commented Oct 5, 2021

I am wondering if this might be a case of sort of "downgrading" the omdadmin from site admin with full privileges to an app-level user (within omd, that is) with limited privileges.

If so, thruk and the omd system should not allow this, or somehow warn the user they are about to shoot themselves in the leg BEFORE they attempt the update.

For now, I will just avoid using omdadmin as a contact.

@sni
Copy link
Contributor

sni commented Oct 6, 2021

the reason is the "authentication tab" when creating a (new) contact:
2021-10-06_11-19
It is set to no permission by default, so if you create a contact for something which is already in the cgi.cfg but no contact yet,
it will get the new permissions.
Not sure if its easy to fix. Two things would need to change:

  • the authentication settings should not immediately apply, instead be used when doing the "save" step.
  • the authentication tab should load the existing settings somehow, although it does not know which user you want to create
  • or it should have a flag whether the settings have been changed and keep it like before unless actively changed

@systemdlete
Copy link
Author

systemdlete commented Oct 6, 2021

Sounds like a conflict between (1) the set of id's that can be OMD admins, and (2) the set of id's that can be OMD contacts. Apparently, the one context can "clobber" the other context if the id's match.

Perhaps these sets can be unified, somehow, for the purposes of these checks.

Another possibility -- maybe not a good one, idk -- is to create omdadmin as a contact in the installation process. I am assuming a dup is not permitted.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants